fsstat is part of The Sleuth Kit, which we’ve discussed installing on a Mac OS X system.
Category Archives: Security
Revisiting Various Bytes
This is the last post (hopefully) on our walk through the boot sector. There are couple byte ranges I want to briefly discuss, so I’m grouping them all into the final post. For reference, here’s our ever-present hex editor screenshot.
Revisiting Bytes 17 and 18
This is an important difference between FAT12/FAT16 and FAT32. In FAT12 and FAT16, the beginning of the data area is reserved for the root directory. In FAT32, the root directory can be located anywhere in the data area.
Revisiting Bytes 14-15 and 16
A FAT file system contains a FAT Area. This is the File Allocation Table area. For now, think of the FAT Area as a list of file names and pointers to the Data Area, and think of the Data Area as the place where a file’s content actually resides. So, we’ve got our boot sector, followed by a list of file names which point to that particular file’s content.
Revisiting Bytes 11-12 and 13
Bytes 11-12 give the number of bytes per sector. Byte 13 gives the number of sectors per cluster.
